Security News New Arena CryptoMix Ransomware Variant Released

[Der.Reisende]

Yesterday, MalwareHunterTeam discovered a new variant of the CryptoMix ransomware that is appending the .arena extension to encrypted file names. This family of ransomware releases a new version almost every week, if not sooner, so it will be expected to see another variant released soon with a new extension.

It should also be noted that this ransomware should not be confused with the recent Crysis variant that appends the .arena extension as well. The easiest way to tell the difference between the CryptoMix and Crysis variants, is that the CryptoMix variant will turn the filenames into a hexadecimal strings as described in the next section.

This article will provide a brief summary of what has changed in this new variant. As we are always looking for weaknesses, if you are a victim of this variant and decide to pay the ransom, please send us the decryptor so we can take a look at it. You can also discuss or receive support for Cryptomix ransomware infections in our dedicated Cryptomix Help & Support Topic.

Read more in the source on:

• Changes in the ARENA Cryptomix Ransomware Variant (mostly cosmetic, the encryption method is unchanged)
• How to protect yourself from the Arena CryptoMix Ransomware
• Technical data

Sample to be found here, kindly shared by @silversurfer: https://malwaretips.com/threads/cryptomix-ransomware.75073/